Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,411 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects attempts to dump LSASS process memory using common tools like procdump, rundll32 with comsvcs.dll, or mimikatz (sekurlsa module), followed by DCOM lateral movement (network connection on port 135) on the same device within a 30-minute window. This sequence of events is indicative of an adversary attempting to steal credentials and then use them for lateral movement within the network.
Detects the suspicious execution chain where mmc.exe is spawned by svchost.exe via DCOM activation (indicated by '-Embedding' in the command line), followed by mmc.exe spawning a command shell (cmd.exe, powershell.exe, or pwsh.exe). This behavior is indicative of lateral movement or privilege escalation using DCOM and MMC20.Application.
This rule correlates three distinct events to detect a potential credential theft and lateral movement chain: an LSASS credential dump, followed by an NTLM network logon, and then a DCOM activation of mmc.exe with the '-Embedding' flag on the target system. This sequence of events is indicative of an attacker compromising credentials, using them to move laterally, and then potentially executing further commands or tools via DCOM.
Detects when 'explorer.exe' performs clipboard access actions such as opening, getting data from, or setting a clipboard viewer. While 'explorer.exe' is a legitimate Windows process, unusual or excessive clipboard activity from it could indicate suspicious behavior, potentially related to data collection or manipulation.
This rule detects suspicious process injection activity where an untrusted process attempts to inject code into common trusted Windows processes (svchost.exe, explorer.exe, notepad.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe) using a combination of VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread API calls. This behavior is often associated with malware, such as StealC, attempting to evade detection and maintain persistence.
Detects attempts to upload files to the SharePoint master page gallery using a POST request. This activity can be indicative of an attacker attempting to establish persistence or deface the SharePoint site by modifying its core components. The rule specifically looks for requests to '_layouts/15/Upload.aspx' or '_layouts/Upload.aspx' with 'RootFolder' and 'List' parameters containing '_catalogs/masterpage' or directory traversal sequences ('../').
This rule detects attempts to install a keyboard hook (WH_KEYBOARD_LL) using the SetWindowsHookEx API, specifically when the initiating process is 'explorer.exe'. This behavior can be indicative of keylogging activity, where an attacker attempts to capture keystrokes.
This rule detects when a process other than the legitimate WinSCP application attempts to access WinSCP saved session credentials. This access can occur either by querying the registry key HKCU\Software\Martin Prikryl\WinSCP 2\Sessions or by reading the portable configuration file 'WinSCP.ini'. This activity is suspicious as it indicates an attempt by an unauthorized process to retrieve sensitive connection information, potentially for credential access or lateral movement.
Detects suspicious usage of the 'curl' command-line tool to perform PUT or POST requests with binary data to specific paths, potentially indicating data exfiltration or command and control communication. The rule excludes common web browsers as initiating processes to reduce false positives.
This rule detects suspicious access to macOS Keychain files or the use of the 'security' utility to manipulate keychains. It specifically looks for 'osascript' accessing keychain-related paths, the 'security' utility using commands like 'unlock-keychain' or 'find-generic-password', or common shell utilities ('cp', 'cat', 'sh', 'bash', 'zsh') accessing keychain database files. This activity is often indicative of credential access attempts.
Page 893 of 1168